regression: upgrade to 1.22.3 (from 1.21.11) broke 'docker login' #13658

New Issue

GiteaMirror · 2025-11-02T10:49:32-06:00

GiteaMirror commented

2025-11-02 10:49:32 -06:00

Originally created by @Spongman on GitHub (Oct 30, 2024).

EDIT: this was caused by the auth token having only scope "write:repository", which was acceptable in 1.21, but is no longer acceptable. using a token with "write:package" scope, works fine.

Description

since upgrading to 1.22.3, my deployment scripts that run 'docker login' are no longer able to log into the gitea repository

$ echo $PASS | docker login -u $USER --password-stdin gitea.corp.company.com
Error response from daemon: Get "https://gitea.corp.company.com/v2/": unauthorized

that's the ROOT_URL of gitea. which is running behind an apache reverse proxy.

i have verified the token exists:

$ curl -H "Content-Type: application/json" -u 'user:PASS' https://gitea.corp.company.com/api/v1/users/system-jenkins/tokens
[{"id":4,"name":"gitea-admin","sha1":"","token_last_eight":"xyzxyzxy","scopes":["write:repository"]}]

nothing has changed except the upgrade.

gitea logs:

2024/10/29 22:58:59 ...eb/routing/logger.go:102:func1() [I] router: completed GET /v2/ for 10.250.9.92:0, 401 Unauthorized in 0.2ms @ container/container.go:129(container.ReqContainerAccess)
2024/10/29 22:58:59 ...eb/routing/logger.go:102:func1() [I] router: completed GET /v2/token?account=system-jenkins&client_id=docker&offline_token=true&service=container_registry for 10.250.9.92:0, 401 Unauthorized in 45.7ms @ container/container.go:152(container.Authenticate)

apache logs:

10.250.9.92 - - [29/Oct/2024:22:58:06 -0700] "GET /v2/ HTTP/1.1" 401 50 "-" "docker/27.2.1 go/go1.22.7 git-commit/8b539b8 kernel/5.14.0-362.8.1.el9_3.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/27.2.1 \\(linux\\))"
10.250.9.92 - - [29/Oct/2024:22:58:06 -0700] "GET /v2/token?account=system-jenkins&client_id=docker&offline_token=true&service=container_registry HTTP/1.1" 401 50 "-" "docker/27.2.1 go/go1.22.7 git-commit/8b539b8 kernel/5.14.0-362.8.1.el9_3.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/27.2.1 \\(linux\\))"

Gitea Version

gitea-1.22.3-linux-amd64

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

official binary, systemd, apache reverse proxy.

Database

MySQL/MariaDB

Originally created by @Spongman on GitHub (Oct 30, 2024). EDIT: this was caused by the auth token having only scope "write:repository", which _was_ acceptable in 1.21, but is no longer acceptable. using a token with "write:package" scope, works fine. ### Description since upgrading to 1.22.3, my deployment scripts that run 'docker login' are no longer able to log into the gitea repository ``` $ echo $PASS | docker login -u $USER --password-stdin gitea.corp.company.com Error response from daemon: Get "https://gitea.corp.company.com/v2/": unauthorized ``` that's the ROOT_URL of gitea. which is running behind an apache reverse proxy. i have verified the token exists: ``` $ curl -H "Content-Type: application/json" -u 'user:PASS' https://gitea.corp.company.com/api/v1/users/system-jenkins/tokens [{"id":4,"name":"gitea-admin","sha1":"","token_last_eight":"xyzxyzxy","scopes":["write:repository"]}] ``` nothing has changed except the upgrade. gitea logs: ``` 2024/10/29 22:58:59 ...eb/routing/logger.go:102:func1() [I] router: completed GET /v2/ for 10.250.9.92:0, 401 Unauthorized in 0.2ms @ container/container.go:129(container.ReqContainerAccess) 2024/10/29 22:58:59 ...eb/routing/logger.go:102:func1() [I] router: completed GET /v2/token?account=system-jenkins&client_id=docker&offline_token=true&service=container_registry for 10.250.9.92:0, 401 Unauthorized in 45.7ms @ container/container.go:152(container.Authenticate) ``` apache logs: ``` 10.250.9.92 - - [29/Oct/2024:22:58:06 -0700] "GET /v2/ HTTP/1.1" 401 50 "-" "docker/27.2.1 go/go1.22.7 git-commit/8b539b8 kernel/5.14.0-362.8.1.el9_3.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/27.2.1 \$linux\$)" 10.250.9.92 - - [29/Oct/2024:22:58:06 -0700] "GET /v2/token?account=system-jenkins&client_id=docker&offline_token=true&service=container_registry HTTP/1.1" 401 50 "-" "docker/27.2.1 go/go1.22.7 git-commit/8b539b8 kernel/5.14.0-362.8.1.el9_3.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/27.2.1 \$linux\$)" ``` ### Gitea Version gitea-1.22.3-linux-amd64 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? official binary, systemd, apache reverse proxy. ### Database MySQL/MariaDB

GiteaMirror added the issue/needs-feedback type/bug labels 2025-11-02 10:49:32 -06:00

GiteaMirror closed this issue

2025-11-02 10:49:33 -06:00

GiteaMirror commented

2025-11-02 10:49:33 -06:00

@wxiaoguang commented on GitHub (Oct 30, 2024):

"scopes":["write:repository"] doesn't seem right.

@wxiaoguang commented on GitHub (Oct 30, 2024): `"scopes":["write:repository"]` doesn't seem right. ![image](https://github.com/user-attachments/assets/712f1602-e1af-4678-8204-b1e31eba0997)

GiteaMirror commented

2025-11-02 10:49:34 -06:00

@Spongman commented on GitHub (Oct 30, 2024):

write:repository worked fine prior to the upgrade.

@Spongman commented on GitHub (Oct 30, 2024): `write:repository` worked fine prior to the upgrade.

GiteaMirror commented

2025-11-02 10:49:34 -06:00

@wxiaoguang commented on GitHub (Oct 30, 2024):

write:repository worked fine prior to the upgrade.

It was a bug. It shouldn't use "repository" permission to access "container(package)"

@wxiaoguang commented on GitHub (Oct 30, 2024): > `write:repository` worked fine prior to the upgrade. It was a bug. It shouldn't use "repository" permission to access "container(package)"

GiteaMirror commented

2025-11-02 10:49:34 -06:00

@Spongman commented on GitHub (Oct 30, 2024):

ok, that sounds reasonable. if prior behavior was overly permissive and has been fixed, that would explain the error.

~~now i just need to work out how to fix my token ;-)~~
i just created a new one with write:package, and it's working now. thanks for your help @wxiaoguang !

@Spongman commented on GitHub (Oct 30, 2024): ok, that sounds reasonable. if prior behavior was overly permissive and has been fixed, that would explain the error. ~now i just need to work out how to fix my token ;-)~ i just created a new one with `write:package`, and it's working now. thanks for your help @wxiaoguang !

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13658